Privacy Policy
Personal Data Processing Policy applicable to contacts, clients, prospects, and beneficiaries of outsourced services
The policy outlined below applies to the processing of personal data carried out by ISPGROUP, holding the companies ISP France, ISP Morocco, Outside BO France, Outside BO Morocco (hereinafter referred to as the data controller).
1 – General provisions
The following provisions concern all personal data processing carried out by the data controller, unless otherwise stated in specific provisions.
- Legal framework – compliance with the GDPR and French law
The data controller declares that it processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, concerning the protection of individuals with regard to the processing of personal data and the free movement of such data (hereinafter referred to as the GDPR) and French Law No. 78-17 of January 6, 1978, relating to data processing, files, and freedoms (as amended).
- Data Controller and Other Participants
The data controller is identified above. Their contact details are: Outside BO France [contact details: 04 78 31 65 30, contact@isp-group.org, www.ISP-group.org].
The representative of the data controller and DPO is Nathalie Lempereur. Her contact details are: 04 78 31 65 30, n.lempereur@isp-group.org, www.ISP-group.org.
- Definition of contacts, clients, prospects, beneficiaries
• “CONTACT” refers to a member of a CLIENT company with a current, future, or past business relationship with the ISP group.
• “CLIENT” refers to a company with a current, future, or past business relationship with the ISP group.
• “BENEFICIARY” refers to a person benefiting from the implementation of a service for which the CLIENT has authorized the ISP group.
• “PROSPECT” refers to a company without a current, future, or past business relationship with the ISP group.
- Recipients of personal data
The recipients of the data are exclusively the permanent employees of Outside BO (France & Morocco).
- Data transfer
The data controller carries out a transfer of personal data within the company Outside BO to a third country, namely Morocco.
The binding corporate rules that apply to ISP Group and its subsidiaries are those of the Binding Corporate Rules (BCR), which refer to the intra-group data protection policy concerning the transfer of personal data outside the European Union.
The parent company ISP Group, through its subsidiaries, acts as the “data controller” under the BCR framework, which governs the transfers made within a group acting as the data controller.
- The recommended process points linking ISO and GDPR
ISP Group, being ISO 9001:2015 certified, ensures that the processes carried out within the company are subject to additional measures regarding employees:
• Appointment of a DPO (Data Protection Officer) as an employee of the company, serving as the primary point of contact for employees.
• Awareness of all staff regarding the GDPR regulations.
• Drafting a confidentiality agreement for employees handling sensitive data, attached to their personnel file.
- Retention period for personal data
The data is retained for the duration of the outsourcing contract and then for 2 years after the last invoice, this period reflecting the established practice for occasional or recurring clients.
- Rights of the person whose data is collected
The person whose personal data is collected has the right to:
– Request the DPO access to personal data, rectification or deletion of such data, or restriction of processing related to the concerned person.
– To object to the processing.
– To the portability of their data.
– To file a complaint with a supervisory authority.
– To withdraw consent at any time, without affecting the lawfulness of the processing based on the consent before its withdrawal. This right applies exclusively when the processing is based on Article 6(1)(a) or Article 9(2)(a) of the GDPR, meaning when the processing is based on the data subject’s consent for one or more specific purposes.
- Automated decision-making – profiling
No profiling will be carried out, and more generally, no automated decisions will be made based on the data collected concerning contacts, clients, or beneficiaries.
Automated decisions will be made regarding PROSPECTS based on the collected data. These decisions concern a qualification principle, specifically which cities and industries they belong to, in order to target our marketing campaigns.
2 – Specific Provisions
The following provisions are specific to each type of personal data processing.
– Management of the relationship with our contacts and prospects
Personal data processed
We process the following personal data:
o Contacts, clients, prospects: personal information such as city, email address, and phone numbers
Purposes – The processing of personal data for CONTACTS, CLIENTS, and PROSPECTS is aimed at managing the relationship with our contacts and prospects. Specifically, this processing seeks to communicate information to the concerned person about updates regarding our organization, products, and services.
Legal Basis – This processing of personal data is based on the consent of the data subject (Article 6, paragraph 1, point a) of the GDPR). The request for data is contractual in nature. The data subject is not obligated to provide this data. If the data subject does not provide the data or withdraws their consent for data processing, they will not, for example, be able to receive information about updates regarding our organization, products, and services.
- Client Acceptance Procedure
Personal Data Processed – We process the following data:
Title, first name, last name, phone number, email address, postal address, profession, organization (company, enterprise, or other), role, requested product or service, distribution channel, transaction conditions, destination territory of the products, identity of the beneficial owner, any specific risks (as per Article L. 561-10 2° of the Monetary and Financial Code).
Purposes – This data processing is intended to fulfill our customer due diligence obligations in accordance with French law, particularly Articles L. 561-4-1 and R. 561-5 of the Monetary and Financial Code.
Legal basis – This processing is necessary to comply with legal obligations to which the data controller is subject. It is based on Article 6(1)(c) of the GDPR. The data request is a prerequisite for establishing a business relationship, in accordance with applicable legislative and regulatory provisions. The individual is required to provide this data if they wish to establish such a relationship. If the individual does not provide the data, we will not be able to pursue a business relationship with them.
– Management of our client relationships
Personal data processed – We process the following personal data: first name, last name, phone number, email address, postal address, profession, product or service purchased, purchase price, any discounts, delivery location, distribution channel, payment terms, payment-related information.
Purposes – The processing of personal data is intended for managing the relationship with our clients. In particular, this processing aims to execute the pre-contractual measures taken at the request of the concerned CLIENT.
– Management of the relationship with the beneficiaries of our clients
Professional services
Personal data processed – We process the following personal data of the beneficiaries of professional services from our clients: name, address, phone number, email.
Services to individuals
Personal data processed – We process the following personal data of beneficiaries of services to individuals from our clients: name, address, phone number, date of birth, and security code.
Legal basis – This processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at their request. It is based on Article 6(1)(b) of the GDPR. The request for data is contractual in nature. The data subject is required to provide this data if they wish to benefit from our products or services. If the data subject does not provide the data, they will not be able to benefit from our services.
- Marketing and advertising messages
Personal data processed – We process the following data: first name, last name, email address, information about opened messages and links clicked (including the date and time of the consultation).
Purposes – The processing is intended to improve our communication and deliver relevant content at the appropriate times.
Automated decision-making – profiling – Automated decisions will be made based on the data collected. The underlying logic of these automated decisions is as follows:
– Any person receiving an email can click on an unsubscribe link that is explicitly included in all of our communications.
– Any person who does not open the first email may receive another email presenting the company.
– If no unsubscription, send a second information email with a link to the website one week later.
– If no unsubscription, send a third information email with a link to the website three weeks later.
Our CRM software, Zoho CRM, is GDPR certified and records and marks all refusals of sending or follow-ups. This unsubscription information is retained. This certification is a key strength of this software: https://www.zoho.com/fr/crm/help/gdpr/
Legal basis – The processing is based on the consent of the data subject (Article 6, paragraph 1, point a) of the GDPR) and is necessary for the legitimate interests we pursue, which consist of improving our communication and avoiding sending inappropriate communications (Article 6, paragraph 1, point f) of the GDPR). The data request is contractual in nature. The data subject is not required to provide this information and can object to its processing at any time. If the data subject does not provide the data or withdraws their consent to the processing, they will not receive tailored communications.
